Devices and applications often transmit event messages to a centralized location for the purpose of maintaining a record of event occurrences that can, for example, be referenced later during system trouble shooting. One example of such messages are syslog messages that are transmitted to a syslog daemon for storage in a message repository. As event messages are collected, the event message repository can become full or overflow. In such a case, important messages can be deleted in favor of newer messages. In addition or exception, performance of the machine on which the repository resides can degrade.
Event messages and the repository in which they are stored are normally managed to avoid such problems. In particular, messages are deleted according to pre-established rules or criteria in order to reduce the number of stored messages and, therefore, provide space for new messages in the message repository. Currently, there are several known processes for message management. In one process, the contents of the repository are checked and adjusted real time. For example, each time an event message is received, the capacity of the repository is checked to determine whether a maximum allowed size has been or will be exceeded. If so, event messages are deleted according to the pre-established rules to make more room. Such a process is inefficient because it involves-a relatively high amount of overhead. In particular, the size determination is made each time a new message is received, regardless of how many messages are currently stored.
In a second process, message deletion occurs on a periodic basis. That is, after a predetermined amount of time has elapsed since the last time deletion was performed, a deletion process is repeated, again according to pre-established rules. That process also has disadvantages. For example, if the selected period is too long, an overflow condition may occur before the period expires. Conversely, if the period is too short, the process is unnecessarily inefficient as in the previously-described process.